0

A consultant has come and gone to do some audit on our SQL server, and has left a bit of a mess here. The problem is that he did things that we don't know anything about.

In the C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA we get a few GB of .trc files, and they keep appearing and growing.

A SELECT * FROM ::fn_trace_getinfo(default) where property = 2 returns 2 lines:

1   2   \\?\C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\audittrace20130910192403_347.trc
2   2   C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Log\log_589.trc

EXEC sp_trace_setstatus 1 ,0 says that we are not allowed to execute sp_trace_setstatus, even when logged as sa.

We have tried this:

sp_configure 'show advanced options', 1 ;
GO
RECONFIGURE ;
GO
sp_configure 'c2 audit mode', 0 ;
GO
RECONFIGURE ;
GO

It says that "the configuration option 'c2 audit mode' has gone from 0 to 0", but exec sp_configure tells us that the run_value of c2 audit mode is still 1.

We're a bit lost as to what we should do to stop the trace files to appear and grow.

  • 1
    Looks like we need to restart the SQL server to take the new config value into account. We'll see tomorrow, as we can't restart the server now. – thomasb Sep 17 '13 at 8:53
0

After setting the c2 audit mode to 0, we had to restart the server... RECONFIGURE wasn't enough.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.